Product:
ColdFusion
Summary
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could exploit this vulnerability to write malicious files to arbitrary locations on the file system. Exploitation does not require user interaction and the scope is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2025-61822 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and can send specially crafted requests to the ColdFusion server over an adjacent network. By manipulating input validation, the attacker can write malicious files to arbitrary locations on the file system without requiring user interaction.
Affected Products
- ColdFusion 2025.4 – Affected by improper input validation leading to arbitrary file system write.
- ColdFusion 2023.16 – Vulnerable to exploitation allowing file writes to arbitrary locations.
- ColdFusion 2021.22 – Subject to the same input validation issues as other versions.
Mitigation
To mitigate this vulnerability, users should update to the latest version of ColdFusion that addresses the improper input validation issue. Additionally, restricting access to the ColdFusion server and monitoring for unusual file system activity can help reduce the risk of exploitation.